What does ICT law cover?
ICT law is not a separate code. It is a collection of rules from contract law, intellectual property law, privacy law and cybersecurity regulation. An ICT law lawyer combines these areas of law and knows the technology to which they apply. An IT law lawyer translates the technology into clear agreements and so prevents disputes.
The legal aspects of digitalisation change quickly. In addition to the Dutch Civil Code (Burgerlijk Wetboek) and the Dutch Copyright Act (Auteurswet), more and more European regulations apply. New technology, such as blockchain and smart contracts, is also subject to the ordinary rules of contract law and the law of evidence.
What should you look out for in IT contracts such as SaaS, licences and SLAs?
An IT law lawyer first looks at the core of an ICT contract. A good contract sets out what will be delivered, which availability applies, who owns the software and data, and how you exit. If one of these elements is missing, a problem often leads to a dispute about what the supplier was required to do.
Under a SaaS contract you purchase software as a cloud service. You do not receive a copy of the software, only access. Agreements on availability, security, the storage location of data and the return of data at the end of the contract are therefore essential. Read more in our article on SaaS contracts and the ownership of your data.
Under a licence you receive a right of use, while the maker retains the copyright. The licence determines how many users, which locations and which purpose are permitted. If you exceed those limits, the licensor can claim additional fees or damages.
Service level agreements (SLAs) describe the quality of service in measurable terms. Think of availability of 99.5 per cent per month, response times per priority level and a service credit if the supplier does not meet those standards.
Escrow protects you if the supplier goes bankrupt or stops maintenance. The supplier then deposits the source code with an independent party. On a predefined event, such as bankruptcy, you obtain access to that source code.
In a development contract you set out the functionality you expect and how acceptance testing works. A fixed acceptance procedure with time limits, for example 10 working days for testing, prevents many conflicts later on.
| Contract element | What you arrange |
|---|---|
| Service description | Functionality, specifications and what falls outside the assignment |
| SLA | Availability, response and recovery times, service credits |
| Intellectual property | Assignment or licence, open source components, existing building blocks |
| Data and privacy | Storage location, security, data processing agreement |
| Liability | Cap, excluded loss, time limits for complaints |
| Exit | Return of data, migration assistance, escrow, notice period |
The supplier's general terms and conditions (algemene voorwaarden) only apply if they were provided in good time. Under Article 6:233 of the Dutch Civil Code, an unreasonably onerous clause may be voidable. That protection does not apply to large companies (Article 6:235 of the Dutch Civil Code). An IT law lawyer reviews those clauses before you sign. See also our service contracts for entrepreneurs.
What does an IT law lawyer do when an IT project fails?
If an ICT supplier fails to deliver or delivers defectively, you can claim performance, termination or damages. You usually first give the supplier written notice of default, with a reasonable period to perform properly after all.
An attributable failure in performance (toerekenbare tekortkoming) gives a right to damages under Article 6:74 of the Dutch Civil Code. The notice of default (ingebrekestelling) is governed by Article 6:82 of the Dutch Civil Code. In it you set a specific period, for example 14 days, to remedy the defects.
Termination (ontbinding) is possible under Article 6:265 of the Dutch Civil Code. In an IT project, termination does not always lead to repayment of everything. What has already been delivered in usable form often falls outside the termination.
There is also a duty to complain (klachtplicht). Under Article 6:89 of the Dutch Civil Code you must complain within a reasonable time after discovering a defect. So record defects in writing straight away, with the date, screenshots and ticket numbers.
Suppliers usually limit their liability to a maximum amount, for example the amount invoiced over 12 months, and exclude consequential loss. Such a limitation generally does not work in the case of intent or wilful recklessness. Relying on it may also be unacceptable by standards of reasonableness and fairness (Article 6:248(2) of the Dutch Civil Code). Read more about when an IT supplier is liable and what to do if your IT supplier does not deliver.
Who owns software, source code and databases?
The copyright in software belongs to the maker, unless the law or a written deed provides otherwise. If you have software built by an external company, that company remains the owner as long as there is no written assignment.
The Dutch Copyright Act protects software as a work. If an employee creates software in the course of employment, the employer is deemed to be the maker under Article 7 of the Dutch Copyright Act. That does not apply to freelancers and external developers. Under Article 2 of the Dutch Copyright Act, an assignment requires a deed, meaning a signed written document.
Without an assignment you have at most a licence. In an acquisition or investment round this often becomes a problem, because a buyer wants to see that the company actually owns its core software. Read more about copyright in custom software.
A database may also be protected under the Dutch Databases Act (Databankenwet) if the maker has made a substantial investment in its contents. Also watch out for open source components. Some licences, such as the GPL, require you to release the source code if you distribute your software.
Is content created by AI protected by copyright?
Content that an AI system generates independently, without human creative choices, is in principle not protected by copyright. Copyright requires a human's own intellectual creation.
If a person does make their own creative choices when using AI, the result may be protected. So set out in contracts who holds the rights to output and training data.
How do you protect your trade mark and intellectual property online?
Trade mark protection starts with registration. You can register a trade mark with the Benelux Office for Intellectual Property (BOIP, Benelux-Bureau voor de Intellectuele Eigendom) for the Benelux, or with the EUIPO for the whole EU. Each registration is valid for 10 years and can be renewed.
A domain name that resembles your trade mark or trade name may infringe your rights. For .nl domain names you can submit a dispute to the dispute resolution scheme of SIDN, the registry for .nl. You must then show, among other things, that the holder has no legitimate interest and is using the name in bad faith.
An ICT law lawyer can act on your behalf before the BOIP, SIDN and the courts. Good trade mark protection and clear agreements on intellectual property in contracts prevent you from having to litigate later. A non-disclosure agreement (geheimhoudingsovereenkomst) also protects knowledge that is not covered by intellectual property.
If you sell online to consumers, the consumer generally has a 14-day cooling-off period (Article 6:230o of the Dutch Civil Code). If you do not provide information about this right of withdrawal (herroepingsrecht), the cooling-off period is extended by up to 12 months. Read more about e-commerce legislation.
What does the GDPR require of your organisation?
The General Data Protection Regulation (GDPR, AVG) requires you to process personal data only on a legal basis, to secure it properly and to report data breaches within 72 hours. The Dutch Data Protection Authority can impose fines of up to €20 million or 4 per cent of worldwide annual turnover.
If a supplier processes data for you, such as a hosting party or SaaS provider, that supplier is a processor (verwerker). Article 28 of the GDPR then requires a data processing agreement (verwerkersovereenkomst). Data processing agreements govern, among other things, the purpose, security, sub-processors and the deletion of data. See also our article on the obligations of a processor.
Under Article 33 of the GDPR you report a data breach to the Dutch Data Protection Authority within 72 hours, unless the breach is unlikely to result in a risk. If there is a high risk, you also inform the data subjects (Article 34 of the GDPR). You always record data breaches internally.
For processing with a high privacy risk, such as large-scale profiling, a DPIA is required in advance (Article 35 of the GDPR). For extensive advice on privacy, please see our page privacy law.
Which European digital rules apply to your business?
An IT law lawyer helps you determine which rules apply to you. In addition to the GDPR, the AI Act, NIS2, the Data Act and the Digital Services Act apply. Which regulation applies to you depends on your sector, your size and your services.
What does the AI Act require?
The AI Act (Regulation (EU) 2024/1689) classifies AI systems by risk. Some applications are prohibited, high-risk systems must meet strict requirements, and other systems are mainly subject to transparency obligations. The regulation entered into force on 1 August 2024 and is being applied in phases:
| Date | What applies |
|---|---|
| 2 February 2025 | Prohibition of unacceptable AI practices and the duty to ensure AI literacy of staff |
| 2 August 2025 | Rules for general-purpose AI models and the supervisory framework |
| 2 August 2026 | Most of the remaining obligations, including transparency obligations |
| 2 August 2027 | Rules for high-risk AI in products already covered by European product legislation |
A postponement of the start date of the rules for high-risk systems has been discussed in the EU. So check for each system which date currently applies. Read more in our article AI systems and compliance.
What do NIS2 and the Cybersecurity Act mean?
The European NIS2 Directive requires medium-sized and large organisations in vital sectors to carry out cybersecurity risk management and to report incidents. In the Netherlands, NIS2 is implemented through the Cybersecurity Act (Cyberbeveiligingswet).
After a significant incident, such as a successful cyber attack, the directive requires an early warning within 24 hours, a notification within 72 hours and a final report within one month. The board itself is responsible for overseeing security. Read more about NIS2 and the Cybersecurity Act.
What do the Data Act and the Digital Services Act regulate?
The Data Act (Regulation (EU) 2023/2854) has applied since 12 September 2025. Users of connected products obtain access to the data they generate, and providers of cloud services must make it possible to switch to another provider.
The Digital Services Act (Regulation (EU) 2022/2065) has applied in full since 17 February 2024. Online platforms and marketplaces must, among other things, have a notice mechanism for illegal content. In the Netherlands, the Authority for Consumers and Markets (ACM, Autoriteit Consument & Markt) supervises compliance.
How does a matter with Law & More proceed?
A matter starts with an intake and an analysis of your contracts and correspondence. Our team then chooses, together with you, the approach that suits your interests, budget and the relationship with the other party.
- Intake. In a free introductory meeting we discuss your situation and any time limits, such as the 72-hour reporting period for a data breach.
- Advice. We assess the contract, the general terms and conditions and the evidence. You receive written advice on your position, the risks and the costs.
- Negotiation. In disputes we send a notice of default and negotiate with the other party. Where useful, we propose mediation so that the working relationship is preserved.
- Proceedings. If a settlement cannot be reached, we litigate. Claims of up to €25,000 are heard by the subdistrict court (kantonrechter). In urgent cases, such as an imminent shutdown of your systems, summary proceedings (kort geding) are possible.
Our team can also draft or review ICT contracts before you sign. That is usually cheaper than a dispute afterwards. Our firm's team assists clients throughout the Netherlands, in Dutch and English, from Eindhoven (Marconilaan 13) and a visiting location in Amsterdam.
